Risk tiers explained

Why tiers at all

An organization may have dozens of AI systems. A spell-checker and a model that decides who gets a loan do not need the same care. Proportionality means matching effort to risk, so that scarce review time goes where harm would be greatest. A tier is simply a label that says how much governance a system needs.

The four EU tiers

The EU AI Act uses four tiers. This is a plain summary; the EU page has the dates and duties by role.

Tier	What it means	Direction of travel
Prohibited	Uses the law bans outright, such as harmful manipulation or social scoring	Do not build or use. Stop and take legal advice
High-risk	Uses in listed areas such as employment, credit and education, or safety parts of regulated products	The heaviest duties: risk management, data quality, documentation, logging, human oversight, testing, monitoring
Transparency duties	Systems that talk to people or generate content people will see	Tell people they are dealing with AI, and mark generated content
Minimal risk	Everything else	No specific legal duties. Your own policy still applies

Dates have moved. Prohibited practices have applied since 2 February 2025. Transparency duties apply from 2 August 2026, with marking for generative systems already on the market by 2 December 2026. High-risk duties for stand-alone uses apply from 2 December 2027, and for AI in regulated products from 2 August 2028 as reported. Treat these as summaries and confirm with the consolidated text.

How other regions think about risk

Not every region uses tiers. In the US there is no federal tiering; several state laws focus on consequential decisions (jobs, credit, housing, health). The UK is principles-based and context-led: regulators judge risk in their own sector. India’s guidelines encourage proportionate, risk-based practice without statutory tiers. The NIST AI RMF is voluntary and asks you to map and measure risk for your own context.

So a single system may be “high-risk” in one place and simply “a decision tool that needs a bias audit” in another. That is why ClearPath asks where people are affected, not only where you are based.

What changes with each tier

Think of governance as a dial. At the low end: a register entry, an owner and the AI use policy. In the middle: a transparency notice, labelling and a vendor check. At the high end: an impact assessment, documented testing including bias and security, human oversight with real authority, logging, monitoring with thresholds and a tested incident plan. The control library derives a control set from a system’s tier and traits.

Common mistakes

• Answering “No” to keep the result low. If you are not sure, answer “Not sure”. The screening tool then assumes the cautious case.
• Classifying the model, not the use. The same model can be minimal risk in one use and high-risk in another. Classify the use.
• Forgetting that purpose changes. Re-run the check when a system is used for something new.
• Treating the tier as a legal conclusion. A screening result is a first filter. Confirm with counsel before you rely on it, especially for possibly high-risk and prohibited results.

Example

A retailer’s team uses AI in three ways: a tool that suggests email subject lines (minimal), a customer chatbot (transparency duties), and a model that ranks job applicants (possibly high-risk). They spend an hour on the first, a week on the second and several weeks on the third, including an impact assessment and a bias test. Same organization, three different levels of care.

What to do now

1. Run the EU screening check on one system.
2. List your systems in the register and record each tier.
3. For anything possibly high-risk, start the impact assessment.